[SOLVED] Use OTRS Login/Pw in External Webpage

[aMescAs]

Hi!

I've managed to make an ASP page in order to every user can see some reports in detail of ticket time units added to OTRS.
However i'd like to have a login page, just like OTRS have. Since i've the DB connection OK and know the table for the login/pw, wouldn't be a problem.

The problem is that the pw field is encrypted with SHA-2, and in ASP I can't seem to get that encryption right for compare purposes!

Any idea of how to workaround this?

Cumps,
Flávio Rocha.

[crythias]

It depends on what you want to accomplish. If you *must* have OTRS's authentication for the third party app, you may want to consider using OTRS API for it. On the other hand, if you have started HTTP/SSO then it gets a bit easier.

[aMescAs]

Hi!

Thanks for you quick reply.
but i didn't quite understand neither the OTRS API or the HTTP/SSO part. Could you elaborate any of those two?

I've search for "OTRS API" and came across with this link: https://otrs.github.io/doc/api/otrs/3.3/index.html . Which module should i use for the login purpose, and how?

On the HTTP/SSO (Single Sign On) part, I understand the idea here, but don't know how to implement.

Cumps,
Flávio Rocha.

[crythias]

What is your goal? Is there a reason you need OTRS auth for this external web page?

[aMescAs]

My goal here is to give access to my ASP page only for the existing users in OTRS, as well the same PWs, with diffent permissions/menus between the different roles.

My page is listing hours and informations on tickets and its an important tool for the system.

[crythias]

The api.
It depends if you're authenticating customers or users...

[aMescAs]

@crythias .. as shown in the quote below, i've already found that link (my OTRS versions is 3.3).

Hi!
I've search for "OTRS API" and came across with this link: https://otrs.github.io/doc/api/otrs/3.3/index.html . Which module should i use for the login purpose, and how?

The authentication is for users only.

The question is how should i do it? Is there examples or any tutorial to follow?

Regards,
Flávio Rocha

[crythias]

Kernel::System::Auth.
But I can't tell you how to get your aspx to vet the exchange. Actually, it'd be more like IIS to vet, and at that point, I'd probably use IIS's security and not think about too much.

[aMescAs]

..and i think this is the API Reference i should use. Or at least it has something to do with it. Am I right? But how?

https://otrs.github.io/doc/api/otrs/3.3 ... th.pm.html

[aMescAs]

Kernel::System::Auth.
But I can't tell you how to get your aspx to vet the exchange. Actually, it'd be more like IIS to vet, and at that point, I'd probably use IIS's security and not think about too much.

What do you mean with "to vet the exchange" ? But using IIS's security, can i accomplish what i need/want (ie, use the same user/pw do access the aspx page)?

[crythias]

s/vet/vette/ verify.
Simplified and generalized: The availability of a web page is secured either by way of an application that generates the page or the web server that provides the page.

By vette/verify I mean by what process is the verification going to take place? The API basically allows for the username and password given in a form to be passed to OTRS and confirmed. If it is confirmed, it will return true. This happens without needing to know how the credentials are stored. The hard part is to use your system to appropriately call the OTRS authentication method and react appropriately to the result.

[eandrex]

Another alternative could be using "SessionCreate" method from OTRS Generic Interface(Webservice).

Or

Extract the attachment in this message in your OTRS installation. Make sure you execute otrs.RebuildConfig.pl after doing so (it may be necessary to exec otrs.SetPermissions too)

Now, from whatever .net language you are using create a GET/POST request to your public.pl interface in this format:

Code: Select all

http://yourotrsdomain/otrs/public.pl?Action=PublicLoginCheck&Username=Agent1&Password=PasswordAgent2

You can test it by using your web browser too(in order to see what it returns )

[aMescAs]

Hi!

@crythias exactly! I don't need necessarily to know how the credentials are stored, but as you said "the hard part" is definitily how to call the OTRS authentication method! That's the whole point in this post.

@eandrex to your first alternative - the "SessionCreate" - I've searched a little bit about it, and i didn't figured it out how to do it.

The other solution presented by you, got my attention! I've tried to do it, but no success.

If no session is started in OTRS, the link just take me to Login Page od the OTRS. If i've a session started, i'm getting this error:



"Error message: Module Kernel::Modules::PublicLoginCheck not registered in Kernel/Config.pm!
Please contact your administrator."

I've already executed otrs.RebuildConfig.pl, otrs.DeleteCache.pl and otrs.SetPermissions.pl
Also i've checked in Sysconfig and enabled it.



but still i've got nothing! Any help?

Regards,
Flávio Rocha.

[eandrex]

If no session is started in OTRS, the link just take me to Login Page od the OTRS. If i've a session started, i'm getting this error:

Are you sure you are using the "public.pl?" that interface should not ask for OTRS credentials even if you are not logged in.

What is the URL you are using?

in my local enviroment, it works as expected

[aMescAs]

That's it!... I was using "index.pl" ..

Thank you very much, I just saved the day!

... I've just one additional question.. a little thing that just came across... When a pw has a special character (for example: " # " ) the login fail everytime. Any ideia why? Or how to fix it?

Regards,
Flávio Rocha

[eandrex]

Thats because you are not supposed to send "#" just like that..

Replace "#" for "%23" and try again

for example: "mypass%23test" should be same as "mypass#test" and it should work.

Same, for example, should apply for "spaces".. you should send "%20" instead of " "

the HttpUtility class in .Net may be useful:

[aMescAs]

Exactly!

I've applied this line:

Code: Select all

HttpUtility.UrlEncode(Login11.Password)

.. and it did the job!

Once again, thank you eandrex!

Cumps,
Flávio Rocha.

[aMescAs]

Hi again!

I've one more challenge in hands, and since it's related with the previous one I think it isn't necessary a new topic...

Question:
As the public login works for agents... is there a way to make it work for customers?

Cumps,
Flávio Rocha